The Privacy Landscape in 2026

Americans 60 and older reported $7.748 billion in fraud losses in 2025, up 59 percent in a single year⁹, while California’s new one-stop deletion tool has already pushed brokers’ reported deletions toward 100 million records³. Privacy in 2026 is both more dangerous and more defensible than it was two years ago.

Your Data Is Scattered, and Someone Is Paid to Gather It

Your name, home address, phone number, birthday, relatives and old posts sit in hundreds of separate places. None of them looks dangerous alone. The danger begins when the pieces are connected, and an entire industry of data brokers and people-search sites is paid to connect them. This paper reviews what changed in 2025 and 2026, what still works, and which advice is now out of date. It is the research companion to The Privacy Blueprint: Shielding Yourself and Those You Love.

The Law Has Moved Faster Than Most People Know

In 2026, 20 states have comprehensive consumer privacy laws in effect (19 if Florida’s narrower law is not counted). Indiana, Kentucky and Rhode Island joined on January 1, 2026, and four more states enacted laws that take effect later¹.

In most of these states you can ask a company to show you the personal data it holds, correct it, delete it, and stop selling it or using it for targeted advertising. About half go further and require companies to honor Global Privacy Control, a browser setting that sends your opt-out automatically to every site you visit. The limits matter too. These laws are enforced by state attorneys general rather than private lawsuits, they cover businesses above size thresholds, and they usually exempt publicly available information, which is exactly the raw material people-search sites use.

California Built the First One-Stop Deletion Tool

The biggest change is California’s Delete Request and Opt-out Platform, known as DROP, at privacy.ca.gov/drop. Since January 1, 2026, a California resident can verify residency and send one deletion request to every data broker registered with the state. Since August 1, 2026, those brokers must check the platform at least every 45 days, delete matched data and report back, or face fines of $200 per request per day².

More than 242,000 Californians had filed by late February 2026 and more than 345,000 by early August. By October the state reported that brokers’ reported deletions were approaching 100 million records³. That number counts records, not people, since one person can appear in many brokers’ files. DROP covers only registered brokers. It does not reach companies you do business with directly, public records, or search-engine results. Vermont, Texas and Oregon run broker registries, and Connecticut and New Jersey have enacted new broker laws, but California’s is the only working government deletion platform today.

The Federal Picture: Enforcement, Not a New Law

There is still no comprehensive federal data-broker law. The Consumer Financial Protection Bureau proposed treating many brokers as credit reporting agencies in December 2024, then withdrew the proposal on May 15, 2025⁴. The Federal Trade Commission has acted case by case against sellers of sensitive location data, with final orders against Gravy Analytics and Mobilewalla in January 2025 and a proposed order in May 2026 that would bar Kochava from selling such data without consent.

People-Search Sites: Removable, and Returning

Spokeo, Whitepages, BeenVerified, TruePeopleSearch, FastPeopleSearch and Nuwber still offer free opt-outs, usually by pasting your profile address and confirming by email or phone. Several brands share one removal system; Intelius, TruthFinder and Instant Checkmate use a single suppression center. The hard truth is relisting: profiles often reappear within months as public records refresh, so a quarterly recheck is part of the job.

Two events show how fast this landscape moves. In August 2026 a New Jersey court transferred radaris.com and related domains to a privacy company after the people-search site ignored thousands of removal demands under New Jersey’s Daniel’s Law⁵. And National Public Data, a broker that lost a dataset advertised at about 2.9 billion records including Social Security numbers, filed for bankruptcy in 2024 and shut down. Most people in that file had never heard of the company. Removal cannot protect you from a broker that was already breached, which is why credit freezes matter.

Search Engines: Google Expanded Its Tool

Google’s free Results about you tool monitors Search for your phone number, email and home address and lets you request removal. On February 10, 2026, Google expanded it in the United States to watch for driver’s license, passport and Social Security numbers as well, added a hub for tracking every request, and reported that more than 10 million people have used it⁶. Removal from Google Search does not delete the page from the web or from other search engines, so the source still has to be addressed.

Your Phone Number Is a Key, and the FCC Rules Are Not in Force

Many articles say the Federal Communications Commission’s 2023 rules against SIM swapping and port-out fraud took effect in 2024. They did not. The FCC adopted the rules, then in July 2024 waived compliance until a new compliance date is published⁷, and as of late 2026 that date had not been set. The protection available today is the one you switch on yourself, free, at your carrier:

• AT&T: Wireless Account Lock.
• Verizon: SIM Protection together with Number Lock. Verizon says both are needed.
• T-Mobile: SIM Protection together with Port Out Protection.

Unlock before upgrading a phone or moving an eSIM, then lock again.

Credit Freezes Remain the Strongest Free Step

Since 2018, federal law has made credit freezes free at Equifax, Experian and TransUnion⁸. Each bureau is frozen separately, and a bureau must lift a freeze within one hour of an online or phone request. Parents can freeze a child’s credit free until age 16. A one-year fraud alert placed with one bureau is shared with the other two, and identity-theft victims can place a seven-year alert. Free recovery plans and pre-filled letters are at IdentityTheft.gov.

The Families Most at Risk

The FBI’s Internet Crime Complaint Center reported that Americans 60 and older filed 201,266 complaints in 2025 and lost $7.748 billion, the largest loss of any age group. For the first time the FBI broke out AI-enabled fraud, including cloned voices in fake family-emergency calls: more than $893 million in losses, $352 million of it from people 60 and older⁹. The FTC separately reported more than $3 billion in fraud losses from older adults in 2025 and estimates the true cost, counting unreported losses, at $13.3 billion to $119.5 billion¹⁰.

The defense is a family verification plan agreed on in advance. Hang up and call your relative back on a number you already have. Use a family phrase that has never appeared online. Treat urgency, secrecy, and payment by gift card, wire, cryptocurrency or cash courier as warning signs. Report quickly to ReportFraud.ftc.gov and ic3.gov.

Advice That Is Now Out of Date

Texted login codes

Codes sent by text can be stolen through SIM swaps. Prefer passkeys, then authenticator apps or hardware keys, and lock your carrier account.

Changing passwords every 90 days

The final 2025 federal guidance, NIST SP 800-63B-4, says organizations should not force routine password changes or require mixtures of symbols. Use long, unique passwords from a password manager, and change one when it is breached.

A VPN makes you anonymous

A VPN shifts trust from your internet provider to the VPN company. It does not stop tracking by accounts you are signed into, phishing or malware.

Opt out once and you are done

Profiles return. Recheck quarterly, and Californians should file with DROP.

Four Real Cases Behind the Blueprint

Amy Boyer, 1999. A stalker bought her Social Security number, home address and workplace from the online broker Docusearch, which obtained the workplace through a pretext phone call. He killed her as she left work on October 15, 1999. On February 18, 2003, in Remsburg v. Docusearch, the New Hampshire Supreme Court held that an information broker owes a duty of reasonable care to the person whose information it sells¹¹.

Judge Esther Salas, 2020. On July 19, 2020, a former litigant who had found the federal judge’s home address online came to her New Jersey door posing as a delivery driver, killed her 20-year-old son Daniel Anderl and wounded her husband. New Jersey’s Daniel’s Law followed in November 2020 and the federal Daniel Anderl Judicial Security and Privacy Act in December 2022¹². Daniel’s Law is still being tested in the courts in 2026¹³.

The Strava heat map, 2017 to 2018. In November 2017 the fitness app published a global map built from about a billion recorded workouts. In January 2018 an Australian student showed that it revealed military bases and the routes service members ran inside them¹⁴. No single runner revealed a secret; thousands of default settings did.

Mat Honan, 2012. In about an hour, attackers used the last digits of a payment card shown by one company to persuade another company’s support line to reset his account. They remotely wiped his phone, tablet and laptop, deleted his email account and hijacked his Twitter account, and years of family photographs were lost¹⁵. Every account is only as strong as the way it can be recovered.

This paper is general education, not legal advice. Laws, company tools and opt-out pages change; start from each organization’s official website. If your safety is at risk, call 911 in an emergency; the National Domestic Violence Hotline is 1-800-799-7233.